pr-guard-mcp

pr-guard-mcp

Enables AI agents to perform security audits on pull request diffs by detecting secrets, dangerous code patterns, and new dependencies, outputting structured JSON for generating PR review comments.

Category
Visit Server

README

pr-guard-mcp

pr-guard-mcp 是一个面向 Pull Request 的安全审计 MCP Server。

它可以让 Codex、Claude Code、Cursor 等支持 MCP 的 AI Agent 对 git diff 或 PR diff 做安全检查，帮助你在代码合并前发现明显风险。

功能

  • 检测新增代码中的密钥泄露，例如 AWS key、GitHub token、数据库连接串、私钥片段
  • 识别高风险代码模式，例如 eval、命令执行、SQL 字符串拼接
  • 识别依赖文件里的新增依赖，例如 package.json、requirements.txt、pyproject.toml、pom.xml
  • 输出结构化 JSON，方便 AI Agent 生成 PR review 评论

安装

npm install
npm run build

本地运行

npm run dev

Demo

npm run demo

示例会分析 examples/insecure.diff，输出类似下面的安全摘要：

{
  "summary": {
    "totalFindings": 3,
    "critical": 1,
    "high": 1,
    "medium": 1
  },
  "findings": [
    {
      "category": "dangerous-pattern",
      "severity": "critical",
      "title": "Potential command execution added"
    }
  ]
}

MCP 工具

analyze_pr_diff

分析一段 unified diff 文本，并返回安全风险列表。

输入：

{
  "diff": "这里放 git diff 或 PR diff 文本"
}

输出字段：

  • summary：按严重程度统计的风险数量
  • findings：具体风险列表，包括类型、严重程度、文件、行号、证据和修复建议

MCP 客户端配置示例

构建完成后，可以把它配置到支持 MCP 的客户端中：

{
  "mcpServers": {
    "pr-guard": {
      "command": "node",
      "args": ["D:/github-xiang-mu/pr-guard-mcp/dist/server.js"]
    }
  }
}

适合场景

  • 合并 PR 前做轻量安全检查
  • 让 AI Agent 生成安全 review 评论
  • 快速检查新增代码里是否出现明显密钥和危险 API
  • 作为后续 GitHub PR 自动审计工具的基础版本

当前限制

  • 第一版只分析传入的 diff 文本，不会主动调用 GitHub API
  • 检测规则以启发式正则为主，不能替代完整 SAST
  • 依赖风险目前只识别新增依赖，还没有接入 npm、PyPI、Maven 漏洞库

后续计划

  • 支持直接输入 GitHub PR URL
  • 接入 GitHub Advisory、npm audit、PyPI advisory 和 OSV
  • 输出 Markdown 格式的 PR review 评论
  • 增加更多语言的危险 API 规则

Recommended Servers

playwright-mcp

playwright-mcp

A Model Context Protocol server that enables LLMs to interact with web pages through structured accessibility snapshots without requiring vision models or screenshots.

Official
Featured
TypeScript
Magic Component Platform (MCP)

Magic Component Platform (MCP)

An AI-powered tool that generates modern UI components from natural language descriptions, integrating with popular IDEs to streamline UI development workflow.

Official
Featured
Local
TypeScript
Audiense Insights MCP Server

Audiense Insights MCP Server

Enables interaction with Audiense Insights accounts via the Model Context Protocol, facilitating the extraction and analysis of marketing insights and audience data including demographics, behavior, and influencer engagement.

Official
Featured
Local
TypeScript
VeyraX MCP

VeyraX MCP

Single MCP tool to connect all your favorite tools: Gmail, Calendar and 40 more.

Official
Featured
Local
graphlit-mcp-server

graphlit-mcp-server

The Model Context Protocol (MCP) Server enables integration between MCP clients and the Graphlit service. Ingest anything from Slack to Gmail to podcast feeds, in addition to web crawling, into a Graphlit project - and then retrieve relevant contents from the MCP client.

Official
Featured
TypeScript
Kagi MCP Server

Kagi MCP Server

An MCP server that integrates Kagi search capabilities with Claude AI, enabling Claude to perform real-time web searches when answering questions that require up-to-date information.

Official
Featured
Python
Neon Database

Neon Database

MCP server for interacting with Neon Management API and databases

Official
Featured
E2B

E2B

Using MCP to run code via e2b.

Official
Featured
Exa Search

Exa Search

A Model Context Protocol (MCP) server lets AI assistants like Claude use the Exa AI Search API for web searches. This setup allows AI models to get real-time web information in a safe and controlled way.

Official
Featured
Qdrant Server

Qdrant Server

This repository is an example of how to create a MCP server for Qdrant, a vector search engine.

Official
Featured